Mer logs still relevant?
I finally gathered the courage to attack this case and found that I was able to establish a web connection in safe mode. I now have a mer log; would it still be useful after all this time?? (and where should I mail it to?)
My problems are:
*wpf messages (no popups) -
*graphics card (nvidia) only in VGA mode - driver is one of the 'replaced' file
*freezes when booting in regular mode (this happened after I uninstalled Malwarebytes, which was mentioned somewhere in the interminable thread to be a problem). Can only boot in safe mode.
* when operating in safe mode w/network : McAfee real time scanner turns itself off right after I turn it on
I figure if this week's meeting produces some kind of useful response from McAfee, I'll keep it - one last try
KristineMessage was edited by: krisser65 on 8/15/11 11:46:02 AM CDT
I was asking whether you had the edit option showing it should be there all the time
Sorry for the time this issue has taken but please be informed that we have a team that has been deployed as soon as this issue was reported , who are working hard on getting things done so fast , I shall update you once I get more info on the same.
Safe mode w/networking as you know is a diagnostic mode in which the system works with minimal drivers loaded up so that’s the reason McAfee would not be enabled in the safe modes
As Dinz says the issue is under investigation. They do not need any more MER logs but keep them in case they do.
Any new info I see I will post here asap.
Re the edit button it disappears when someone replies, this a feature of the forum sorry. I forgot it was this way.Message was edited by: Peacekeeper on 16/08/11 7:15:40 AM
I am having the same problem, which started last week after a Security Center software update was automatically sent to my Dell laptop (running Windows XP SP3). Unlike everyone who has posted so far, I am not a techie. I have no idea what files might be getting replaced, and other than the WPF message every time I boot up I haven't noticed anything amiss. Should I disable McAfee (not sure which is worse - files being replaced or no antivirus software)? Is there any way to check what might have been replaced?
Thanks in advance for any suggestions.
My advice is to disable real-time scanning and updates indefinitely. I did this within two hours after getting the first WFP warning, and it stopped any further damage been caused. So, I strongly recommend you disable those without further delay, and do not reactivate them until McAfee provides a solution.
To check what files are missing:
1. Click Start > Click Run...> Type: sfc /scannow > Let the scan run to completion, dismissing the pop-ups during the scan.
2. After the scan has completed, open Notepad.
3. Click Start > Control Panel > Administrative Tools > Computer Management > Event Viewer > System..
4. In the Source column, doubleclick the entries that say: Windows File Protection. In the Description (for some of those entries) it has a missing filepath (eg. "The system file <filepath> could not be copied into the DLL cache.") , copy and paste each missing filepath into Notepad and you will have a list of the missing files and filepaths.
I've been keeping an eye on things since first adding to this thread. I've done nothing about replacing files because it's beyond my capabilities. I've got an OEM MCE 2002 SP2 disk which I guess isn't going to do the trick and can't be streamlined. My computer is acting ok as far as I can tell. I ran a Malwarebytes scan again today and got the WFP error about files being replaced by unrecognized versions when it was scanning dll files but it went too fast for me to figure out which one it was. I restarted the computer after that to get rid of the WFP box without telling it that I wanted to keep the unrecognized files. After it started back up I went into event viewer and discovered that a different set of dll files from what I had seen in the past could not be verified because WFP was terminating. I updated SuperAntispyware and had to reboot for that to take affect. That time, only one file showed up in the event log. I can't tell if the dll file errors are on start up or shutdown. But for me, two different things seem to be going on. When I run spyware scans, I get the WFP error for unrecognized files. On either shut down or start up, I get WFP errors for as many as 5 or as few as 1 dll files, with the files varying on the mood of the computer I guess. Those WFP errors indicate that the files could not be verified because WFP was terminating. I don't know if this will shed any light on what is going on or not but I thought I'd toss this in in case someone from McAfee itself takes a look at this thread. Much thanks to all who are trying to help.
I've been reading through and posting to this thread for the past few days. I just figured out how to see what needed replaced when I ran scannow and discovered that I am missing the same files that you are missing. the other problems that I've mentioned in other posts are that I get WFP errors when running Malwarebytes and SuperAntispyware. I've noticed logs in the event viewer of various files not being verified because WFP was shutting down when I've restarted the computer. It could be one or many files. I'm running MCE 2002 SP3 and have an OEM CD with SP2 so I haven't even tried to copy files. It's beyond my capabilities. Anyway, my system seems to be running ok in spite of everything. I never use media center but that's what the missing files are for. Just as a test, I opened it up and was able to view my pictures and play my music so I don't know what to think. I just hope McAfee comes up with a fix for us because I will have to hire someone to fix the mess if the system fails. I found it interesting that you and I are missing the same files.
Have been reading through the many, many pages of this thread & figured I'd just post this comment at this end, as a postscript?. Who knew that my "network connectivity" problem reported 2 months back on a separate thread (caused by WFP) was actually caused by McAfee; well yes, it was suspected as it surfaced with Security Centre 11. It was never actually resolved, I just found a "weekly" workaround that requires me to reinstall my network driver, after WFP replaces it, after McAfee has updated. No, I didn't plan to live this way forever but was monitoring for current "issues" re. McAfee & Halleluiah ! here's the one that matters I Fortunately I have had mostly "file could not be verified as WFC is shutting down" messages, as opposed to the "file replacement" damage experienced by many quoted here. The level of WFP activity I was observing, while trying to figure out this network problem, however is now understood, sort of, not really, not clear exactly what McAfee is actually doing & "why/".
At this point I am conflicted. My Subscription runs out in one week; I must decide about renewing; I am being asked to pay 50% more than I paid last year for a service which is responsible for the bulk of my PC investigating/debugging activity (on Software which is supposed to do some of that work for me) & much more than I had ever planned to expend. Is this "thing" close to resolved (or even understood) ? Informed feedback would be appreciated. Tx. GB
I am another WIN XP user with Windows File Protection problem. It started with a McAfee update on 08/08/2011. My system is as follows:
Dell XPS 410
Win XP Media Center Edition, Ver 2002, SP 3
Dell Dimension DXP061
Intel Core 2 CPU, 6600 @ 2.40 GHz, 2.39 GHz
3.0 Gb RAM, 926 Gb Disk Drive
All windows updates are current. I have 3-User McAfee Internet Security. I only run VirusScan. I do not run any other McAfee add-on, firewall, anti-spam, etc....Here is my "about" box:
McAfee Security Center
Last Update 8/5/2011
- - - - - - - - - -
Last Update: 8/17/2011
DAT Ver: 6440
DAT Creation Date: 8/16/2011
Boot DAT Version: 6432.000
Boot DAT Creation Date: 8/8/2011
Engine Version: 5400.1158
- - - - - - - - - -
More details about my problem:
As stated, this started on 08/08/2011. My McAfee update is set to "Download updates but notify me before installing".
I saw the update notice, clicked to install the update, and after it said that computer required a re-start.
I chose restart later, dismissed the dialog, and turned off the computer.
THe next day, upon startup I started to get the Windows File Protection messages. I found this forum thread several days ago, and have read all of the content in here.
I have taken a MER log, I have a 1.9 MB TGZ file available if the moderator wants it.
Today I also became aware that like others, that the Windows File Protection messages occur on the re-start following a McAfee update. After the second re-start, the computer seems happy. I also observed the string of 64008 events on the shutdown immediately after the McAfee update
I ran the SFC /SCANNOW and it kicked the following into my event log. A bunch of 64021, then 64020 and 64005 on ehtray.exe, and a final 64021
- - - - - - - -
SFC /SCANNOW results in Event Log
Event ID: 64021
Description: The system file <filename> could not be copied into the DLL cache.
The specific error code is 0x000004c7 [The operation was canceled by the user.]
This file is necessary to maintain system stability.
c:\program files\windows media player\mplayer2.exe
c:\program files\windows media player\npdsplay.dll
c:\program files\windows media player\npwmsdrm.dll
c:\program files\windows media player\npdrmv2.dll
c:\program files\windows media player\wmpns.dll
Event ID: 64020
Windows File Protection scan found that the system file <filename> has a bad signature.
This file was restored to the original version to maintain system stability.
c:\windows\ehome\ehtray.exe The file version of the system file is 5.1.2715.2765.
Event ID: 64005
The protected system file <filename> was not restored to its original, valid version
because the Windows File Protection restoration process was cancelled by user interaction,
user name is <my login ID>.
c:\windows\ehome\ehtray.exe The file version of the bad file is 5.1.2715.2765.
Event ID: 64021
- - - - - - - -
Today, after an Update, I saw the following string of 64008 in the Event Log at shutdown
Event ID: 64008
The protected system file <filename> could not be verified as valid
because Windows File Protection is terminating.
Use the SFC utility to verify the integrity of the file at a later time.
- - - - - - - -
My system seems to work fine when I dismiss the WFP dialogs. Usually at startup it is ehtray.exe file validation messages in the Event Log. I agree with the others, that this is pathetic that McAfee could release code that would bungle up the XP system to this extent.
Moderators, please contact me if you want my MER log
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: